Legal

Privacy Policy

Last updated: April 7, 2026

ForgeBody ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our AI weight loss coaching service delivered via WhatsApp. This policy complies with UK GDPR and the Irish Data Protection Act 2018.

1. Information We Collect

When you sign up for ForgeBody, we collect:

• Personal details: First name, age
• Health data (special category): Current weight (kg), goal weight (kg). Processed under your explicit consent per GDPR Art. 9(2)(a).
• Contact information: UK or Irish WhatsApp number
• Payment information: Processed by Paddle — we never store your card details
• Message history: WhatsApp conversations between you and your AI coach
• Food photos: If you send MMS photos for nutritional analysis, they are processed and not stored permanently

2. How We Use Your Data

We use your information to:

• Deliver personalized AI coaching via WhatsApp
• Send daily check-in messages and coaching responses
• Process subscription payments via Paddle
• Improve coaching quality based on conversation history
• Send service-related communications (billing, updates)

We do not use your data for advertising, sell it to third parties, or share it for any purpose other than delivering the service.

3. WhatsApp Consent (GDPR Art.9 + PECR)

By checking both consent boxes during signup, you provide two separate consents:

• Health data consent (GDPR Art.9(2)(a)): Explicit consent to process your weight and wellness data as special category health data. You may withdraw this at any time - withdrawal means we can no longer deliver coaching.
• WhatsApp marketing consent (PECR / ePrivacy): Consent to receive automated coaching and marketing messages via WhatsApp. Consent is not a condition of purchase.
• Opt-out: Reply STOP to any WhatsApp message. You will receive one confirmation, then no further messages.
• Message frequency: 1-3 messages per day (daily check-in + coaching replies)

4. Third-Party Services

We use the following third-party providers to operate ForgeBody:

• Anthropic (Claude API) — AI model that generates coaching responses. Messages are processed per Anthropic's Privacy Policy.
• Twilio — WhatsApp delivery infrastructure (EU DPA signed). Messages pass through Twilio's systems per their Privacy Policy.
• Paddle — Payment processing (Merchant of Record for UK/IE, handles VAT). Card data is handled by Paddle per their Privacy Policy. We never see your full card number.
• Supabase — Secure database storage on EU servers (Frankfurt, Germany). Data does not leave the EU.

5. Data Storage & Security

Your data is stored on secured servers with industry-standard encryption. We use:

• Encrypted database (Supabase / PostgreSQL)
• HTTPS for all data transmission
• Access controls limiting who can view your data

While we take reasonable measures to protect your data, no system is 100% secure. If a breach occurs that affects your rights, we will notify you within 72 hours as required by applicable law.

6. Data Retention

We retain your data as follows:

• Active subscribers: Data retained for the duration of your subscription
• Cancelled accounts: Data deleted within 90 days of cancellation
• Payment records: Retained for 7 years as required by tax law (processed by Paddle)
• Message history: Retained for coaching context; deleted with your account

7. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a portable format
• Withdraw WhatsApp consent: Reply STOP to any message at any time
• Withdraw health data consent: Email us — this will end your coaching service
• Lodge a complaint: UK residents: ICO (ico.org.uk). Irish residents: DPC (dataprotection.ie)

To exercise any right, email support@tryforgebody.eu. We will respond within 30 days as required by UK GDPR / Irish DPA 2018.

8. UK & Irish Residents - Your GDPR Rights

Under UK GDPR and the Irish Data Protection Act 2018, you have the right to:

• Access (Art.15): Request a copy of all data we hold about you
• Rectification (Art.16): Request correction of inaccurate data
• Erasure (Art.17): Request deletion of your account and all associated data
• Portability (Art.20): Receive your data in a structured, machine-readable format
• Withdraw consent (Art.7(3)): Withdraw health data or WhatsApp consent at any time
• Object (Art.21): Object to processing where our legal basis is legitimate interest

ForgeBody does not use your data for advertising, profiling, or automated decision-making that produces legal effects. Your health data is processed solely to deliver the coaching service.

10. Children's Privacy

ForgeBody is intended for adults aged 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, contact us immediately at support@tryforgebody.eu.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via WhatsApp or email at least 7 days before taking effect. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or requests:

• Email: support@tryforgebody.eu
• Website: tryforgebody.eu